X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/72c95e8434cf4f2c96d2320eec13cbc01580cb52..b86f9b8409bb55162dfc7d4d13ea3ee577cce525:/IkiWiki/Render.pm

diff --git a/IkiWiki/Render.pm b/IkiWiki/Render.pm
index 911e9c273..35d663a7a 100644
--- a/IkiWiki/Render.pm
+++ b/IkiWiki/Render.pm
@@ -69,7 +69,15 @@ sub genpage ($$$) { #{{{
 	my $content=shift;
 	my $mtime=shift;
 
-	my $template=template("page.tmpl", blind_cache => 1);
+	my $templatefile;
+	run_hooks(templatefile => sub {
+		return if defined $templatefile;
+		my $file=shift->(page => $page);
+		if (defined $file && defined template_file($file)) {
+			$templatefile=$file;
+		}
+	});
+	my $template=template(defined $templatefile ? $templatefile : 'page.tmpl', blind_cache => 1);
 	my $actions=0;
 
 	if (length $config{cgiurl}) {
@@ -262,34 +270,37 @@ sub refresh () { #{{{
 			}
 		},
 	}, $config{srcdir});
-	find({
-		no_chdir => 1,
-		wanted => sub {
-			$_=decode_utf8($_);
-			if (file_pruned($_, $config{underlaydir})) {
-				$File::Find::prune=1;
-			}
-			elsif (! -d $_ && ! -l $_) {
-				my ($f)=/$config{wiki_file_regexp}/; # untaint
-				if (! defined $f) {
-					warn(sprintf(gettext("skipping bad filename %s"), $_)."\n");
+	foreach my $dir (@{$config{underlaydirs}}, $config{underlaydir}) {
+		find({
+			no_chdir => 1,
+			wanted => sub {
+				$_=decode_utf8($_);
+				if (file_pruned($_, $dir)) {
+					$File::Find::prune=1;
 				}
-				else {
-					# Don't add pages that are in the
-					# srcdir.
-					$f=~s/^\Q$config{underlaydir}\E\/?//;
-					if (! -e "$config{srcdir}/$f" && 
-					    ! -l "$config{srcdir}/$f") {
-					    	my $page=pagename($f);
-						if (! $exists{$page}) {
-							push @files, $f;
-							$exists{$page}=1;
+				elsif (! -d $_ && ! -l $_) {
+					my ($f)=/$config{wiki_file_regexp}/; # untaint
+					if (! defined $f) {
+						warn(sprintf(gettext("skipping bad filename %s"), $_)."\n");
+					}
+					else {
+						$f=~s/^\Q$dir\E\/?//;
+						# avoid underlaydir
+						# override attacks; see
+						# security.mdwn
+						if (! -e "$config{srcdir}/$f" && 
+						    ! -l "$config{srcdir}/$f") {
+						    	my $page=pagename($f);
+							if (! $exists{$page}) {
+								push @files, $f;
+								$exists{$page}=1;
+							}
 						}
 					}
 				}
-			}
-		},
-	}, $config{underlaydir});
+			},
+		}, $dir);
+	};
 
 	my %rendered;
 
@@ -343,7 +354,7 @@ sub refresh () { #{{{
 	}
 	run_hooks(needsbuild => sub { shift->(\@needsbuild) });
 
-	# scan and rendder files
+	# scan and render files
 	foreach my $file (@needsbuild) {
 		debug(sprintf(gettext("scanning %s"), $file));
 		scan($file);